Nowadays, multiple networks are provided on board vehicles such as busses, trains, ships, and aircraft. For example, networks of modern aircraft normally comprise multiple separated (segregated) domains. A domain (or network domain) is usually formed by a subset of components or devices of the network that are registered with and served by a central server. For safety reasons, such separate domains must be strictly hardware and software segregated from each other on board of aircraft. Examples of such aircraft network domains are the Air Craft Domain (also often referred to as Aircraft Control Domain) (ACD), the Airline Information Services Domain (AISD) and the Passenger Information and Entertainment Services Domain (PIESD). The ACD provides flight-safety related control and cabin systems, the AISD provides airline business and administrative support, and the PIESD provides passenger entertainment such as In-Flight Entertainment (IFE). It goes without saying that different security levels are assigned to these different domains. Referring to the foregoing examples, the ACD has the highest security level.
Although the aircraft network domains are strictly separated, they are usually monitored and controlled on one display of a control panel. Each of the segregated network domains is usually monitored and controlled by means of a specific Human Machine Interface (HMI) assigned to the respective network domain. According to this approach, in one control panel, each different network domain has its own browser supporting its own HMI. Usually, one or more of such control panels are provided on board of aircraft for control of cabin components and devices such as lights and air conditioning inside the aircraft cabin. In addition, information associated with the cabin, cabin components or cabin devices may be displayed on such control panels, such as, for example, a passenger call or the current temperature. DE 10 2008 035 090 A1 and US 2010 020038 A1 describe examples of such control panels.
For safety reasons, a hardware switch is provided to switch between the different HMIs of the different domains as presented on the display of the control panel. The hardware switch can be controlled, for example, by a Field Programmable Gate Array (FPGA). As a consequence, only one HMI can be viewed at a time and can only be changed to another HMI by switching the hardware switch. Likewise, user inputs for inputting data via or into the HMIs, for example, via a touch screen or separate input unit, are specific for the respective HMI which is currently displayed so that the input can only be forwarded to the network domain associated with the respectively displayed HMI. In short, according to this approach, by hardware (e.g., the switch) and software (e.g., the separate HMIs) assure that there is no unwanted exchange of data between the different domains.
According to one refinement of this approach, unidirectional data communication from the domain with the highest security level (according to the above example, ACD) to the lower level security domains (the AISD and the PIESD in the above example) may be allowed. Such unidirectional data communication from the highest security domain to the lower security domains does not cause any safety concerns, as it is, for example, not safety critical that the ACD domain can influence the PIESD domain and thus, for instance, the IFE system.
Accordingly, there is a demand for an improved technique of providing human machine interfaces for segregated network domains.
According to a first aspect, a data processing device for providing a human machine interface for control of multiple network domains provided on board a vehicle, for example, on board an aircraft, is proposed. The data processing device comprises a graphics processing component and a display unit. The graphics processing component is configured to obtain first graphic data related to a first graphical human machine interface for control of a first network domain, for example, a first aircraft network domain, and one or more second graphic data. The one or more second graphic data are related to one or more second graphical human machine interfaces for control of one or more second network domains, for example, one or more second aircraft network, domains. The display unit is configured to display a human machine interface. The human machine interface comprises the first graphical human machine interface and at least one of the one or more second graphical human machine interfaces.
The human machine interface (which may also be referred to as graphical human machine interface) may be configured such that all elements or components, e.g., data fields or the like, contained in the first human machine interface and contained in at least one of the one or more second human machine interfaces is visible at the same time on the human machine interface. It also conceivable that the human machine interface allows switching from one human machine interface to the other by means of a touch input or the like. For example, the first human machine interface and at least one of the one or more second human machine interfaces may be contained in the same window or on the same page, but the at least one of the one or more second human machine interfaces or the first human machine interface may not be displayed. e.g., because it is hidden by another of the one or more second human machine interfaces and the first human machine interface. In this case, the non-displayed, e.g., hidden elements may be displayed, e.g., unhidden, by means of a user input.
A different level of security (security level) may be assigned to the first network domain in comparison with the one or more second network domains. In other words, the first network domain may have a different security level than the one or more second network domains. For example, the first network domain may have the highest security level. The one or more second network domains may have the same, similar or different security levels, respectively.
The first network domain may be an Air Craft Domain (Aircraft Control Domain) (ACD). The one or more second network domains may be or comprise an Airline Information Services Domain (AISD) and/or a Passenger Information and Entertainment Domain (PIESD). The number of network domains provided on board the vehicle, e.g., provided on board the aircraft, is not limited to any specific number. For example, two or more network domains may be provided. There may be one first network domain and one or more second network domains. For example, if there are three network domains, the graphics processing component may be configured to obtain first graphic data being related to a first graphical human machine interface for control of a first (aircraft) network domain, second graphic data being related to a second graphical human machine interface for control of a second (aircraft) network domain, and third graphic data being related to a third graphical human machine interface for control of a third (aircraft) network domain. The display unit may be configured to display a graphical human machine interface. The human machine interface may comprise the first graphical human machine interface, the second graphical human machine interface, and the third graphical human machine interface. Likewise, the types mentioned above by way of example are not limited to the ACD, AISD and PIESD. Just to mention one additional or alternative example, the one or more second network domains may be or comprise a Passenger Owned Devices Domain (PODD).
Each of the first and one or more second network domains may comprise one or more network systems, each of which may comprise any number of network components or network devices such as sensors, actuators and the like. When referring to network domains on board of an aircraft and more specifically to the ACD, the ACD may at least comprise a cabin system, the cabin system comprising one or more further systems such as an air-condition system. The air-condition system may comprise any number of sensors or actuators for carrying out operations related to air-conditioning.
The data processing device may comprise a first interface via which the data processing device is connectable to the first network domain. The data processing device may comprise a processing module such as an ARM module. The data processing device may comprise a first interface via which the data processing device is connectable to the first network domain. Similarly, one or more second data processing devices may respectively comprise a second interface via which each of the one or more second data processing devices is connectable to a respective one of the one or more second network domains.
According to a first embodiment, the data processing device may comprise a merging component configured to merge the first graphic data (which is related to the first graphical human machine interface) and at least one of the one or more second graphic data (which are respectively related to the one or more second graphical human machine interfaces). The merging component may be implemented on a low level hierarchy underlying the applications running on the data processing device. The merging component may comprise a window manager and a rendering component. The window manager may be configured to integrate at least one of the one or more second graphical human machine interfaces into the first graphical human machine interface. The rendering component may be configured to render the pixels of the human machine interfaces integrated into each other to form one single main human machine interface.
The graphics processing component may be configured to receive at least one of the one or more second graphic data via a bidirectional data connection. For example, for each of the one or more second graphic data, a bidirectional (duplex) data connection may be provided. Via the bidirectional data connection, the graphics processing component may receive the one or more second graphic data from the one or more second data processing devices, respectively, and the graphics processing component may transmit the one or more second graphic data to the one or more second data processing devices, respectively.
In accordance with a first conceivable variant of the first possible embodiment, the graphics processing component may be configured to obtain first operating data being related to the first network domain, e.g., the first aircraft network domain. The first operating data may be or relate to information about one or more components or devices arranged in the first network domain. Just to give on example, the first operating data may be related to a value measured by a sensor, e.g., a temperature sensor, arranged in the first network domain. For example, multiple values may be sensed by temperature sensors of an air-conditioning system and may be provided to the cabin system. The cabin system may form a human machine interface from the multiple sensed values and possibly further values from other systems within the cabin system and may provide the respective data related to the formed human machine interface to the network domain, e.g., the ACD. The human machine interface may then be regarded as the human machine interface for control of the first network domain.
The display unit may be configured to display the first operating data on the human machine interface or as part of the human machine interface. Alternatively or additionally to the first conceivable variant of the first possible embodiment, the data processing device may comprise an input unit configured to receive an input of first control data via the human machine interface. The first control data may be or relate to information for control of one or more components or devices arranged in the first network domain. Just to give one example, the first control data may be a target temperature value for driving an air-conditioning unit arranged in the first network domain, more precisely in an air-conditioning system of the cabin system of the first network domain. The input unit may be configured to forward the first control data to the graphics processing component of the data processing device. The data processing device may then forward the first control data via its interface to a server of the first network domain which is responsible for controlling the respective one or more components or devices of the first network domain based on the first control data.
In accordance with the first embodiment, the graphics processing component may be configured to receive the one or more second graphic data and one or more second operating data being related to the one or more second network domains, for example, one or more second aircraft network domains, via a common bidirectional data connection, respectively. The one or more second operating data may be or relate to information about one or more components or devices arranged in the one or more second network domains, respectively. Alternatively or additionally, the graphics processing component may be configured to transmit the one or more second graphic data and one or more second control data being related to the one or more second network domains, for example, one or more second aircraft network domains, over a common bidirectional data connection, respectively. The one or more second control data may be or relate to information for control of one or more components or devices arranged in the second network domains, respectively.
For each bidirectional data connection, a communication filter may be provided. Each communication filter may be configured to filter out graphic data, operating data, or control data that does not fulfill one or more predetermined criteria. In other words, the communication filter may be configured to let through only graphic data, operating data, or control data that fulfills the one or more predetermined criteria. Each communication filter may comprise the same or different sets of commands or data types, which are allowed to pass and which will be rejected. By comparing data transmitted over the bidirectional data connection with such sets of commands or data types, the communication filters allow the transmitted data to pass or not.
According to a second embodiment, the data processing device may comprise a graphic control unit such as a graphic controller. The graphic control unit, e.g., the graphic controller, may comprise the graphics processing component. In other words, the graphic control unit, e.g., the graphic controller, may be configured to obtain the first graphic data being related to the first graphical human machine interface and at least one of the one or more second graphic data.
According to a first variant of the first embodiment, the graphic control unit, e.g., the graphic controller, may be configured to write the first graphic data into a video buffer area (e.g., a frame buffer) assigned to the first human machine interface and to write at least one of the one or more second graphic data into a mask area of the video buffer area. The mask area may be at least a subarea of the video buffer area.
According to a second variant of the first embodiment, the graphic control unit, e.g. the graphic controller, may be configured to write at least one of the one or more second graphic data into a mask area which is separate from the video buffer area.
Independent of the exact configuration of the mask area, the graphic control unit. e.g., the graphic controller, may be configured to receive a control input that specifies the mask area.
The display unit may be configured to retrieve the first graphic data and at least one of the one or more second graphic data from the video buffer area and the mask area to form the human machine interface on the display unit. For example, if the mask area is configured as a subarea of the video buffer area, the display unit may read out all pixel data of one frame contained in the video buffer area. As the mask area is part of the video buffer area, the frame displayed on the display unit includes the pixel data contained in the video buffer area including the mask area. In consequence, the frame displayed on the display unit comprises the first human machine interface and at least one of the one or more second human machine interfaces dependent on the data contained in the mask area. By reading out several such frames, the human machine interface can be displayed for a certain time.
The display unit may be configured to display the human machine interface by alternately displaying the first graphic data and at least one of the one or more second graphic data at a frame repetition frequency (which may also be referred to as image repetition frequency or frame repetition rate or simply frame rate or frame frequency) that is higher than a predetermined threshold, e.g., a predetermined frame repetition frequency. The predetermined threshold may be chosen such that the human eye perceives the first human machine interface and at least one of the one or more second human machine interfaces not as individual frames. As the human eye and its brain interface, the human visual system, can process 10 to 12 separate images per second, the frame repetition frequency may be at least 50 Hz or 60 Hz or even higher. If such an image repetition frequency is chosen to alternately display the first and at least one of the one or more second human machine interfaces, a viewer perceives the first and the at least one of the one or more second human machine interfaces as one single human machine interface.
In accordance with the second possible embodiment, the data processing device may comprise a data obtaining component configured to receive at least one of the one or more second operating data being related to the one or more second network domains: for example, one or more second aircraft network domains, via a bidirectional data connection and/or to transmit at least one of the one or more second control data being related to the one or more second network domains, for example, one or more second aircraft network domains, via a bidirectional data connection. Regarding the one or more second operating data as well as the one or more second control data, it is referred to the exemplary explanations given above with respect to the first embodiment.
In accordance with the second embodiment, at least one of the one or more second graphic data may be transmitted to the graphic control unit. e.g., the graphic controller, separately from the transmission of the one or more second operating data.
For each bidirectional data connection, a communication filter may be provided. Each communication filter may be configured to filter out operating data or control data which does not fulfill one or more predetermined criteria. In other words, the communication may be configured to let through only operating data or control data which fulfills the one or more predetermined criteria as described with respect to the first embodiment.
As the graphical data may be transmitted separately from the operating data or control data, the communication filters may be simplified. For example, each of the communication filters may be configured to understand only simple commands, but does not have to distinguish between graphical data and operating or control data.
In accordance with the second embodiment, the data processing device may further comprise a switching component. The switching component may be configured and arranged to receive the at least one of the one or more second graphic data and to selectively forward one of the one or more second graphic data to the graphic controller. The switching component may be provided, for example, in case of a limited number of input ports at the graphic controller. The switching component may be controlled by a Field Programmable Gate Array (FPGA) or other suitable control devices. The FPGA may be used instead of other control devices for safety reasons.
According to a second aspect, a cabin management panel is provided. The cabin management panel may comprise the data processing device as described herein. For example, the cabin management panel may be an aircraft cabin management panel such as a flight attendant panel (FAP).
According to a third aspect, a method for providing a human machine interface for control of multiple network domains provided on board a vehicle, for example, on board an aircraft, is proposed. The method comprises: obtaining first graphic data being related to a first graphical human machine interface for control of a first network domain, for example, a first aircraft network domain, and one or more second graphic data, the one or more second graphic data being related to one or more second graphical human machine interfaces for control of one or more second network domains, for example, one or more second aircraft network domains; and displaying a human machine interface, the human machine interface comprising the first graphical human machine interface and at least one of the one or more second graphical human machine interfaces.
According to a fourth aspect, a computer program product is provided. The computer program product comprises program code portions for carrying out one or more of the steps of any one of the method aspects described herein, when the computer program product is run or executed on a computer system or on one or more computing devices (e.g., a microprocessor, a microcontroller or a digital signal processor (DSP)). The computer program product may be stored on a computer-readable recording medium, such as a permanent or rewritable memory.
All of the above described aspects may be implemented by hardware circuitry and/or by software.
Even if some of the above aspects are described herein with respect to a data processing device or cabin management panel, these aspects may also be implemented as a method or as a computer program for performing or executing the method. Likewise, aspects described as or with reference to a method may be realized by suitable units (even if not explicitly mentioned) in the data processing device, the cabin management panel or by means of the computer program.